🚨 ACTIVE EXPLOITATION
- Hackers exploit chained Plex Media Server flaws in the wild to deploy XMRig cryptominer
Attackers are exploiting unpatched Plex Media Server vulnerabilities in the wild to install an XMRig cryptominer and proxy software.- Affects internet-facing Plex Media Server versions before 1.43.3.10828; fixed in 1.43.3.10861 (Plex Desktop 1.115.0 also updated)
- Plex2Shell, a public exploit published on GitHub on October 16, chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 for unauthenticated remote code execution
- The chain uses SSRF, access to owner-authorized requests, arbitrary file write, and loading of an unsigned codec to execute code; it supports Linux and Windows targets
- A researcher's honeypot was compromised on October 17, 2026, receiving an XMRig miner and proxy software; observed source IPs include 45.194.92[.]222, 91.92.40[.]202, 176.65.139[.]228, and payload host 217.60.194[.]116
- Exploit requests targeted /player/timeline/subscribe with a Python-urllib/3.10 user agent and sslip.io hostnames; payloads named docker and x were downloaded
💥 BREACHES & INCIDENTS
- OpenCode Console breach may have exposed users' OpenAI, Anthropic, and Google API keys
OpenCode disclosed a breach of a legacy system tied to a large-scale distillation attack that may have exposed provider API keys of 1.4% of Console users.- Affected: roughly 1.4% of OpenCode Console users with external OpenAI, Anthropic, or Google provider keys saved in the hosted Console; users without a notification email were not impacted.
- An intruder reached a legacy OpenCode system on the night of October 16; OpenCode links the incident to a large-scale distillation attack, with details undisclosed and the incident described as ongoing.
- Provider keys are bearer credentials usable for billable requests until revoked; deleting them from Console doesn't revoke them, and users report losses up to $1,700 in unauthorized usage.
- Local CLI/desktop keys stored in a SQLite database on users' machines were not affected, according to co-founder Dax Raad.
- OpenCode emailed affected users on October 17 and is working with Anthropic, OpenAI, and Google on remediation; attackerscontinued attacks through October 18.
🔓 CVEs & KEV
- CVE-2026-16487 — CVSS 8.1 — Bootc: containers-common: bootc: automatic updates can apply unsigned mutable...
🕵️ RESEARCH & DEEP DIVES
- Unpatched Broadcom Wi-Fi WPS Flaw Lets In-Range Attackers Run Code as Root on Routers
A flaw in Broadcom's Wi-Fi Protected Setup lets attackers within radio range run code as root on affected routers with no patch available.- Broadcom's WPS implementation, embedded in routers and access points from dozens of vendors, is estimated to affect millions of devices worldwide.
- The bug mishandles reassembly of fragmented WPS setup messages, letting an attacker in radio range corrupt memory, read device memory, and execute arbitrary code as root — no password or pairing required.
- Researcher Quentin Kaiser demonstrated exploits against Belgian provider gateways: exfiltrating the Wi-Fi PSK from an Orange Belgium Askey TCG3000 and opening a reverse shell over Wi-Fi frames on a Proximus Sagemcom BBOX3V+.
- Older eCos-based chips (BCM3380, BCM3383, BCM33834) will never be patched — a 'forever day' — while Linux-based models (BCM3390, BCM65xx, BCM68xx) could be fixed if vendors switch Wi-Fi software.
- No CVE has been assigned; Broadcom has reportedly known about the flaw since 2018, and code traces back to at least 2010. No real-world attacks have been observed.
📋 ADVISORIES
PwnEscape (CVE-2026-99999): Critical Linux kernel flaw enables KVM guest-to-host escape
A critical Linux kernel networking flaw, CVE-2026-99999, lets a guest VM leak host memory and, in lab tests, execute code on the host.- Affects Linux hosts running untrusted VMs — cloud sandboxes, multi-tenant KVM/Firecracker setups, and enterprise Linux kernels (EL7–EL10, RHEL, AlmaLinux, Rocky, Oracle, CloudLinux); vulnerable code dates back to Linux 2.6.27 (2008).
- Guest-supplied checksum offload metadata (CHECKSUM_PARTIAL) makes the host write two bytes into an already-validated IPv4 header, leaking ~32 bytes of host memory per packet and enabling crashes and host code execution.
- Found by pwn.ai's Paulos Yibelo during Vercel's $1 million sandbox challenge; memory leak was demonstrated against Vercel's production sandboxes, while host code execution was shown only in lab KVM/Firecracker environments.
- Rated 9.3 Critical (CVSS 3.1) with a local attack vector; no public exploit or in-the-wild exploitation reported.
- Fixed by upstream commit 6785011f8b16, backported to stable branches: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11.
October 2026 Windows Server updates can break Exchange Server email services
Microsoft confirmed that October 13, 2026 Windows Server updates can disrupt on-premises Exchange Server email services.- Affects on-premises Exchange Server 2016, 2019, and Subscription Edition on Windows Server 2016/2019/2022/2025 after October 13, 2026 updates (KB5126646, KB5126655, KB5126651, KB5126868)
- Symptoms include OWA sign-in failures, messages stuck in Outbox, growing mail queues, DAG quorum issues, MapiExceptionMdbOffline (ec=1142) errors, and Event ID 1006
- Cause: updates introduced a default limit of 512 simultaneous Endpoint Lookup calls in the Windows Endpoint Mapper (RPC), which heavy Exchange workloads can exceed
- Microsoft's workaround is a registry change setting EpmapSavedContextCap to 65536 under HKLM\SOFTWARE\Microsoft\Rpc, followed by a reboot; issue is listed as mitigated, not resolved
- The failures stem from Windows Server changes, not the October Exchange security updates, and can occur even without those Exchange patches installed